Skip to content
CVE Tracker
Back

CVE-2016-10549

Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration…

Medium4.4EPSS 0.64%
Published
Updated
Reserved
Assigned by
hackerone

Description

Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This would allow an attacker to make AJAX requests to vulnerable hosts through cross site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. Note that this is only an issue when `allRoutes` is set to `true` and `origin` is set to `*` or left commented out in the sails CORS config file. The problem can be compounded when the cors `credentials` setting is not provided. At that point authenticated cross domain requests are possible.

Scores

CVSS scores of CVE-2016-10549, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0Medium4.4CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS (exploitation in 30 days)
0.64% · top 49% of all CVEs (3 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.4.

Weakness

Affected products

Affected packages

From reviewed advisories of the GitHub Advisory Database.

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2016-10549 badge
[![CVE-2016-10549](https://trackcve.app/badge/CVE-2016-10549.svg)](https://trackcve.app/cve/CVE-2016-10549)

Record last updated .